In the process of migrating from DD-WRT to OpenWRT I ended up with a bad flash at some point along the way. And during "troubleshooting" I ended up making things worse, but then better, and worse, and slightly better now.
I'm close to the finish line of fixing this thing...
... but need to fix/replace uboot. And maybe reflash after correcting the flash layout?
Current setup:
This board does not have JTAG but I have serial console connected, with TFTP server running on my laptop. No issues with TFTP transfer with TPlink recovery mode (via 192.168.0.66), and TFTP from uboot's CLI (via 192.168.0.10) works as well, but I don't know what addresses to load/erase/copy or flash bins to use for flashing with this method. I have kmod-mtd-rw installed in psuedo-booting openwrt install, so I can reflash bootloader from running system, but don't know what should be overwritten and with which file.
Limitation on flashing: The normal factory recovery via TFTP works only with the openwrt's factory-to-openwrt image, NOT oem factory image due to software version checks (TFTP downloads OK but refuses to flash oem firmware due to installed xxx-WRT version "7.0" > oem firmware file's v "1.2"), and NOT dd-wrt factory-to-ddwrt either for other weird reasons. TFTP from uboot cli appears to have no limitations, but again, not sure what files/addresses to use, or if the file length field and/or other file headers on the factory-bin needs to be cut off prior to flash, etc.
Problem 1) Partially corrupted uboot, only "manual boot" works, plus screwed up flash layout (prob 2)
Successfully flashed openwrt factory bin, but it will not boot.
Firmware for this device normally has a double-uboot start, uboot booting twice before launching the kernel. Currently, the initial uboot run works (and I am able to get uboot cli through that first run) but the system freezes/stops when it tries to run uboot the second time. See "known good" boot log: https://openwrt.org/toh/tp-link/archer_a7_v5#openwrt_bootlog
Last console spew of normal broken boot startup:
U-Boot 1.1.4-g8fda4a3b-dirty (Feb 24 2018 - 18:17:06)
ap152 - Dragonfly 1.0
DRAM: 128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 393k for U-Boot at: 87f9c000
Reserving 16448k for malloc() at: 86f8c000
Reserving 44 Bytes for Board Info at: 86f8bfd4
Reserving 36 Bytes for Global Data at: 86f8bfb0
Reserving 128k for boot params() at: 86f6bfb0
Stack Pointer at: 86f6bf98
Now running in RAM - U-Boot at: 87f9c000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:23:7f:55:22:ad
eth0 up
eth0
Setting 0x181162c0 to 0x40802100
factory boot check integer ok.
factory boot load fs uboot len 131072 to addr 0x80010000.
Hit any key to stop autoboot: 0
## Starting application at 0x80010000 ...
(Hangs/freezes/halts ...)
If I break into the uboot cli, I can manually boot the kernel and it will run, but I have to do this manual process everytime the device re/boots:
(...)
factory boot check integer ok.
factory boot load fs uboot len 131072 to addr 0x80010000.
Hit any key to stop autoboot: 0
**ath> boot**
## Booting image at 9f040000 ...
Image Name: MIPS OpenWrt Linux-5.10.146
Created: 2022-10-14 22:44:41 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2244051 Bytes = 2.1 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x9f040040 ...OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728
Starting kernel ...
[ 0.000000] Linux version 5.10.146 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19803-9a599fee93) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Fri Oct 14 22:44:41 2022
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] MIPS: machine is TP-Link Archer A7 v5
[ 0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
(...)
Problem 2) While attempting to get a "clean/normal flash", I upgraded the factory bin with the sysupgrade bin. I can set password/change settings and nvram is retained across reboots. But the flash layout seems to be messed up.
Layout after flashing factory bin:
[ 0.455991] 2 uimage-fw partitions found on MTD device firmware
[ 0.462159] Creating 2 MTD partitions on "firmware":
[ 0.467300] 0x000000000000-0x000000230000 : "kernel"
[ 0.473352] 0x000000230000-0x000000ec0000 : "rootfs"
[ 0.480736] mtd: device 4 (rootfs) set to be root filesystem
[ 0.486684] 1 squashfs-split partitions found on MTD device rootfs
[ 0.493130] 0x000000620000-0x000000ec0000 : "rootfs_data"
[ 0.500361] 0x000000f40000-0x000000f60000 : "info"
[ 0.506353] 0x000000f60000-0x000000fb0000 : "config"
[ 0.513901] 0x000000fc0000-0x000000fd0000 : "partition-table"
[ 0.520808] 0x000000ff0000-0x000001000000 : "art"
Layout after flashing sysupgrade bin:
[ 0.426513] Creating 7 MTD partitions on "spi0.0":
[ 0.431532] 0x000000000000-0x000000020000 : "factory-uboot"
[ 0.442047] 0x000000020000-0x000000040000 : "u-boot"
[ 0.448097] 0x000000040000-0x000000f00000 : "firmware"
[ 0.455989] 2 uimage-fw partitions found on MTD device firmware
[ 0.462161] Creating 2 MTD partitions on "firmware":
[ 0.467303] 0x000000000000-0x000000223e13 : "kernel"
[ 0.472457] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[ 0.482629] 0x000000223e13-0x000000ec0000 : "rootfs"
[ 0.487771] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 0.498131] mtd: device 4 (rootfs) set to be root filesystem
[ 0.504901] 1 squashfs-split partitions found on MTD device rootfs
[ 0.511345] 0x000000610000-0x000000ec0000 : "rootfs_data"
[ 0.517824] 0x000000f40000-0x000000f60000 : "info"
[ 0.525258] 0x000000f60000-0x000000fb0000 : "config"
[ 0.531342] 0x000000fc0000-0x000000fd0000 : "partition-table"
[ 0.539576] 0x000000ff0000-0x000001000000 : "art"
I'm thinking the whole thing needs to be erased and reflashed, uboot included, but I don't know which method is best (mtd write mtdX-Z, uboot cli> tftp 0x???? which.bin, etc). And no real clue on which files to use for flashing via uboot cli versus other methods, nor addresses/mem map, etc.
So.... What is the best approach to fixing this thing?
I appreciate input on this. Thanks!